Architecture, requirements and code review in one evidence trail.

Cedars International develops CCDS, a cybersecurity product publicly described in terms of security operations, risk and decision support. Wavect’s engagement combined documentation and QA with subsequent technical assessment. Cedars supplied product knowledge and implementation information; Wavect structured, reviewed and connected the evidence.

Architecture descriptions, requirements, asset records and operating responsibilities answer different questions. To support a product decision, they need consistent definitions and a traceable relationship to the available software evidence.

AI introduces another layer: an application test can establish behavior under specified conditions, while model-quality evaluation needs representative tasks and criteria. Reviewers must keep these forms of evidence distinct and make the scope of each conclusion explicit.

We began with documentation structures and drafting guidance: architecture, requirements, technical assets and access, roles, and third-party governance. Cedars supplied the product-specific information. We supported successive reviews and cross-references so the documents could be used together, including the link from a requirement to its verification.

The later assessment examined selected source paths, repository tests and isolated checks using synthetic inputs. For the AI review, we organized the evidence around intended use, information handling, human oversight and evaluation criteria. Each check had a defined scope.

The reporting paired observations with priorities, proposed actions and recheck criteria. That combined software QA with technical discovery, giving the team concrete work to take forward from the assessment.

• Evidence trail, Architecture, requirements, assets and responsibilities organized for review.
• Targeted checks, Source review and controlled tests informed priorities for follow-up.
• Recheck criteria, Assessment reporting paired proposed actions with subsequent verification.

Engagement: QA and technical assessment. Year: 2026.

PHP, JavaScript, Python, FastAPI, scikit-learn, MySQL, MariaDB.

Useful assurance connects technical observations with a decision, an owner and a verification criterion. Documentation becomes more valuable when the team can maintain that relationship as the product changes. For another QA engagement in a different setting, see Polity.